Panther low experimental python

AWS Network ACL Restricts Outbound Traffic

This policy validates that Network ACLs have some restrictions on outbound traffic.

View Source

Detection Logic

# This is generic policy that checks outbound traffic rules on a Network ACL.
# It is recommended you add additional logic for your own use cases.


def policy(resource):

    for entry in resource["Entries"]:
        if entry["RuleAction"] == "allow" and entry["Egress"]:
            # Check if entry is set to "All Ports"
            if entry["PortRange"] is None:
                return False
    return True

Field Validations

Loading…

Comments (0)

Loading comments...